Using Velocity Expressions to Retrieve Values from Event Fields or Variables

Velocity expressions can be used to construct rule actions or velocity variables that need to access values in event fields or other variables. Rule actions can use velocity expressions in commands and notification messages. In these contexts, you need to write the velocity expression (there are no drop-down lists of fields provided, unlike in rule conditions). (See Managing Rule Actions and Rule Actions Best Practices.)

You can construct most global variables and local variables simply by using the provided pick lists of event fields in the functions. However, the Arithmetic function Java Mathematical Expressions and the String function EvaluateVelocityTemplate are velocity variables that require you to write a velocity expression. (See Local and Global Variables.)

The syntax for constructing a velocity expression is the same, whether for rule actions or velocity variables.

Retrieving Values from Event Fields

To retrieve the value of an event field, use the field name in camel notation without any spaces, preceded by a dollar sign ($):

$<fieldNameInCamelNotation>

For example, to retrieve the value of the Attacker Address field, use: $attackerAddress

For more about event fields, see Data Fields.

Using Variables in a Velocity Expression

To retrieve the value of a variable, use the variable name preceded by a dollar sign ($). If the variable name contains a dot, remove the dot and use camel case. If the variable name contains a space, use an underscore. See the following formats:

$<VariableName>
$<variable_Name>

For example:

Credit Card Number

$Credit_Card_Number

dhcp.Hostname

$dhcpHostname

Login User.Account Number

$Login_UserAccount_Number 

For more information, see Variables.